Know before you click.
Haven is AI threat detection built for the moment before damage: the link in a text, the "urgent" email, the file someone sent. Scan it first, and get a verdict with reasons, not a shrug.
The scanner on the right runs the real Haven model, right here in your browser. Nothing you type is sent anywhere.
Haven model v0.1.0: trained from scratch on 47,489 verified phishing URLs (PhishTank · OpenPhish) against 1M legit domains · AUC 0.971. Every number, explained.
Scan anything. A link from a text, a DM, an email.
You'll get a risk score, the specific reasons behind it, and what to do — computed on this device in milliseconds.
Haven checks the four doors scammers use.
Every attack has to arrive through something: a link, a message, a file, or a phone call. Haven inspects each one before it touches you, and shows its reasoning. A verdict you can argue with is a verdict you can trust.
The click
Haven tears the URL apart before you load it: lookalike domains, punycode impersonation, hidden redirectors, raw IPs, urgency bait, and whether the domain already appears in live phishing feeds.
Example reason you'd see: "Many hyphens in the domain, a classic lookalike pattern."
The read
Paste any email or DM. Haven flags the documented moves: fake urgency, suspended-account threats, gift-card payments, refund overpayment cons, remote-access requests, and senders claiming to be your bank from a free mailbox.
Example reason: "Claims to be an institution but sends from a free mailbox."
The download
Before you open it: executable wrappers, double extensions dressed as invoices, macro documents, archive-smuggled payloads — the shapes every maldoc campaign has used for a decade. (Content-level deep scanning arrives with the next engine milestone; Haven tells you this plainly.)
Example reason: "invoice_0442.pdf.exe is dressed up as a harmless type."
The phone
Scam calls follow scripts. Haven knows the scripts — the fake fraud department, the arrest warrant, the gift-card payment, the "grandma, it's me" emergency — and matches them live against what the caller is saying.
Example reason: "'Fraud department' script: real banks never move your money over the phone."
Caught in the wild.
Exact hosts from the phishing snapshot Haven ships with — the same list your scanner checks before the model even runs. If one of these lands in front of you, the verdict is instant.
loading feed snapshot…
Local or cloud. You choose, and we show the trade.
This isn't buried in settings or fine print. It's the second-biggest decision in the product. Both modes use the same engine; the difference is exactly one thing: whether anonymous signals help train the shared model.
Local mode — default
Your links, messages, files and stats never touch a Haven server. Slower to improve: the shared model only gets smarter when people opt into cloud mode.
Cloud mode — opt-in, reversible
Contributes anonymous threat signals (flagged domains, verdict patterns, model error reports). Never your message bodies, file contents, or identity. Full payload spec on the Transparency page.
Honest status: cloud mode's backend isn't connected yet. Until it is, Haven runs local-only no matter what the switch says, and the dashboard will tell you so. We won't pretend otherwise.
One protection, every screen.
Haven ships as an installable app that runs on all of it: phones, tablets, desktops, and every modern browser, from one optimized codebase. The local engine is tuned to stay under 50 ms per link scan and under 300 ms per file check.
See the performance budget →Pay once. Or don't pay at all.
No subscriptions. No per-device tax. Three one-time tiers. The first one is genuinely free, not a trial with a countdown.
Haven Free
$0 forever
- ✓Unlimited link & message scans
- ✓Live phishing feed + full model
- ✓Local dashboard & history
- —File & call-script analysis
- —Household protection
Most chosen
Haven Personal
$29 once
- ✓Everything in Free
- ✓File & call-script analysis
- ✓Every platform, unlimited devices
- ✓Full history & protection score
- ✓Lifetime model updates
Haven Guardian
$79 once
- ✓Everything in Personal
- ✓Covers 5 people — parents, kids, grandparents
- ✓Shared threat alerts for the household
- ✓Priority access to new engine milestones
Nothing in the fine print.
A protection product you can't inspect is just another thing asking for trust. So Haven publishes everything — here's the short version:
What we train on
Public, citable phishing feeds (PhishTank, OpenPhish) and the web's top-1M legit domains. Metrics published with every model version.
What leaves your device
In local mode: nothing. In cloud mode: a precisely documented, anonymous signal payload — spec published, opt-in, reversible.
What Haven can't do
v0.1 judges links, messages and file shapes — it doesn't deep-scan file contents yet. Limitations are listed, not hidden.
What we'll never do
Sell your data, dark-pattern a subscription, or pretend a heuristic is a guarantee. If it changes, you'll read it here first.
Fair questions.
Is the scan really running on my device?
Yes. The model is a 3.5 KB file your browser downloads once, then every scan is computed locally — you can watch the network tab: scanning sends nothing. The top-domain list is cached after first load.
How accurate is it, honestly?
On a held-out test set the v0.1 model reaches 96.5% precision at its danger threshold and 96% at its warning threshold, with AUC 0.971. That's strong for a purely structural model — and not perfection. Roughly 4 in 100 random little-known legit domains get an unnecessary warning; that's exactly what the amber "suspicious" band and the reasons list are for. We publish every version's numbers.
Why is the mascot an owl?
Harry The Haven sees in the dark, sits watch while you rest, and asks "hoo's there?" before letting anything in. Also: owls swallow scams whole and cough up the bones, which felt right.
What happens to my dashboard data?
It stays in your browser's local storage on this device. Clearing site data clears it. Account sync is designed and will be opt-in when the app ships — the dashboard says exactly what would sync before you'd ever enable it.